Approve the component, not the pile
Sign-off applies to the unit that changed. A component approved once is approved everywhere it is used, which removes the repeat sign-offs a document model creates.
Approval is the moment a piece of content becomes usable, and in a regulated setting it is also the moment that has to be evidenced later. If sign-off happens in email and the record is assembled afterwards from whatever can be found, the evidence is a reconstruction. It does not have to be.
In a document-based operation the sign-off usually lives outside the content: an email, a meeting note, a signature page scanned back in. The content moves on, the approval stays where it was given, and the connection between the two is something a person has to re-establish when an auditor asks.
Approval against a component removes that gap. The state of the content and the fact of its approval are the same record, held at the level the approval was actually given.
Dx5 carries built-in approval workflows and snapshot capability inside the organization's own SharePoint. The approval is given against the component, and every document assembled from that component inherits the approved state rather than requiring its own sign-off.
Sign-off applies to the unit that changed. A component approved once is approved everywhere it is used, which removes the repeat sign-offs a document model creates.
Snapshot capability fixes the approved state as a version, so what was approved can be produced later exactly as it stood.
Identity, access control and version history are SharePoint's and Entra ID's, so the approval record sits inside the audit perimeter the organization has already signed off.
We do not make that claim, and it is worth being precise about why. Dx5 records approval against a component and a version through workflows built into the platform, with the identity coming from Microsoft Entra ID and the record held in your own SharePoint. Whether that satisfies a specific electronic signature or records rule in your framework is something to test against your own procedures with us.
The change record, with author, date and approval attached to the component version rather than to a document that contains it. Where-used references travel with it, so the record can be exported showing what was approved and which assemblies reference it. Job history logs the background operations that followed, which is how propagation is evidenced rather than asserted.
Where-used reporting at the fragment level lists every map and assembly that references the component, so the reach of a sign-off is visible rather than assumed. Broken link and orphan detection covers the other direction, the references that no longer resolve. What sign-off the assembled release itself needs is a workflow design question, and it is worth settling before the first cycle runs.
Microsoft Entra ID and SharePoint permissions, the same ones that control the rest of the content estate. There is no separate user model to provision, and none to deprovision when somebody changes role or leaves, so the approver list does not drift away from the corporate one. Conditional access rules apply unchanged, because there is no second access regime to reproduce them in.
It stays where it was given. A later version is a new record against the same component rather than an overwrite of the old one, and fragment-level version history keeps both retrievable. A snapshot taken at the time freezes the state as it stood, so what was approved in a given month is answered from the record instead of from memory.
Pick the content set where 'who approved this, and when' currently takes a week to answer. That is the set where component-level approval changes the most.